CoinDCX is back in the spotlight. Blockchain investigators say the Indian exchange is misrepresenting a roughly $16 million outflow, and Protos framed the dispute with a headline accusing CoinDCX of lying about the hack. CoinDCX rejects that reading. The company says the flagged addresses are old wallets from its July 2025 security incident, not evidence of a new breach.
The facts sit in three layers. CoinDCX confirmed a July 2025 incident involving an internal operational wallet. Investigators flagged later movements of about 15.99 million USDT and 5,783.81 TRX. What nobody has established is whether this is a fresh $16 million hack, and the word “lying” remains an allegation attributed to investigators, not a finding.
This analysis separates what is confirmed from what is claimed, explains why the dispute matters for exchange users, and looks at where it could go next. It also fits a pattern we have tracked all month, including the Duelbits crypto casino hack that left $7M gone and zero suspects. Coverage came from Protos, CryptoTicker, TradingView, Coinpedia, Kalkine India and Analytics Insight.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
CoinDCX Hack Claim: What Investigators Allege
The challenge to CoinDCX began with on-chain data. Blockchain investigator Darcy reported movements involving approximately 15.99 million USDT and 5,783.81 TRX tied to addresses linked to the exchange. TradingView, republishing a Moneycontrol report, headlined the story as CoinDCX denying a second hack while investigators allege a $16 million theft.
A second investigator, ZachXBT, pushed further. According to the reporting, he challenged CoinDCX’s explanation, including the claim that a CoinDCX deposit address remained in use after the July 2025 incident. Coinpedia’s headline went a step beyond that and said ZachXBT told users to withdraw all funds. We cannot verify that framing beyond the outlet’s own headline, so treat it as a report of his stance, not a confirmed instruction.
The core of the investigators’ case is a timing argument. If an address the exchange calls deprecated still handled customer-facing activity after the breach, the “old wallet” explanation looks weaker. That argument does not prove a new hack. It does raise a fair question about how the exchange managed its wallet inventory after July 2025.
What CoinDCX Officially Confirmed in July 2025
The baseline is CoinDCX’s own incident report, dated July 19, 2025. In it, the company disclosed a security incident affecting an internal operational wallet and said it had reported the matter to CERT-In, India’s national cyber emergency response team.
CoinDCX also drew a hard line between that wallet and customer money. It said customer assets were separate from the affected wallet and that its reserves were fully backed 1:1. That claim is the foundation of the company’s current defense, and it matters because exchanges live or die on customer confidence in reserves.
Notably, the official report does not by itself settle the 2026 dispute. It establishes that a breach happened in July 2025, that regulators were told, and that the company said users were insulated. It says nothing about what investigators later flagged, which is why the two sides can both point to the same history and reach opposite conclusions.
The Numbers on Record
Few hard figures exist in this story, and that scarcity is part of the problem. The table below lists every number that appears in the reporting and who it comes from. Anything else you see circulating on social media falls outside the verified record.
| Data point | Value | Attributed to |
|---|---|---|
| Official incident report date | July 19, 2025 | CoinDCX |
| Flagged USDT movement | Approx. 15.99 million USDT | Investigator Darcy |
| Flagged TRX movement | 5,783.81 TRX | Investigator Darcy |
| Address creation date (claimed) | January 2025 | CoinDCX |
| Compromise date (claimed) | July 2025 | CoinDCX |
| Reserve backing | 1:1, per the company | CoinDCX |
| Regulator notified | CERT-In | CoinDCX |
The USDT figure is the headline, and the TRX figure is a rounding error by comparison. One report describes approximately $16 million in flagged transfers, while another says CoinDCX did not provide a dollar figure for the operational loss. Both can be true at once. Investigators measure what moved on-chain, and the company has not published what it actually lost.
CoinDCX’s Response: Old Wallets, Deprecated Addresses
CoinDCX denied that the flagged activity represented a new hack and called the claims misleading. Its explanation runs in three steps. The addresses were created in January 2025, compromised in the July 2025 incident, and deprecated afterward. Under that account, the movements investigators spotted are leftovers from a known event.
What Sumit Gupta Said
Co-founder and CEO Sumit Gupta said the addresses involved were old wallets and that current CoinDCX wallets had not been breached. When asked about the flagged activity, he said: “Yes, aware of that. We’re investigating it further, and will share an update soon.”
Gupta also gave a customer-facing assurance: “We assure that no user funds will be at loss.” Those two lines are the only on-record quotes in the verified material, and they commit the company to a follow-up. A promised update that does not arrive quickly will hurt more than the original allegation.
The wording is also worth reading closely. Gupta did not say nothing happened. He said the wallets are old and that current wallets are intact. That is a narrower claim than “no incident,” and it leaves room for the investigators’ timing question to stay open.
Where ZachXBT Challenges the Deprecation Story
The sharpest point of conflict is the deposit address. ZachXBT challenged the idea that a CoinDCX deposit address remained in use after July 2025 if the wallet set had truly been retired. A deprecated address should stop receiving routine customer traffic. If it kept doing so, either deprecation was incomplete or the address history is more complicated than the exchange described.
This is the kind of detail that decides credibility fights in crypto. Both sides can read the same public ledger, so the gap comes down to interpretation and context only the exchange holds. Investigators see flows. CoinDCX sees internal labels, wallet roles and migration records that outsiders cannot audit.
The cleanest way to end the argument is documentation. A timestamped wallet migration log, or a signed statement mapping old addresses to retirement dates, would let outside analysts test the company’s story. So far, reports do not mention that kind of evidence being published.
Confirmed, Alleged and Unconfirmed: Sorting the Claims
Headlines compress nuance, so here is a plain sort of the claims. The test is simple. Confirmed means the company or a primary source states it. Alleged means a named investigator asserts it. Unconfirmed means no source in the record supports it.
| Claim | Status | Basis |
|---|---|---|
| A July 2025 incident hit an internal operational wallet | Confirmed | CoinDCX incident report, July 19, 2025 |
| CoinDCX told CERT-In | Confirmed (by the company) | CoinDCX report |
| Customer assets were separate and reserves 1:1 | Company assertion | CoinDCX statements |
| About 15.99M USDT and 5,783.81 TRX moved | Alleged by investigator | Darcy’s on-chain reporting |
| The addresses were created January 2025 and deprecated after July 2025 | Company assertion, disputed | CoinDCX versus ZachXBT |
| CoinDCX suffered a new $16M hack | Unconfirmed | No source establishes it |
| CoinDCX was “lying” | Unconfirmed allegation | Attributed to investigators |
| Exact dollar value of any additional loss | Unconfirmed | Reports conflict on whether a figure exists |
Read down the status column and the shape of the story becomes clear. The firm facts are old. The new facts are claims. That is not a reason to dismiss the investigators, who have a decent record of surfacing problems exchanges would prefer to bury. It is a reason to keep the word “hack” attached to July 2025 until someone proves otherwise.
Why Operational Wallets Matter More Than Headlines Suggest
CoinDCX stressed that the July 2025 wallet was operational, not a customer vault. That distinction sounds like spin, but it is a real architectural difference. Exchanges typically keep several wallet tiers, from hot wallets that process daily withdrawals to cold storage that holds the bulk of reserves. An operational wallet sits closer to the company’s own working capital.
Customer Reserves Versus Company Funds
If an attacker drains company-owned funds, customers can remain whole while the exchange takes the loss. That appears to be CoinDCX’s position, and it explains the Gupta assurance about user funds. But the argument only holds if the segregation is real. Users cannot check it themselves, which is why proof-of-reserves practices and independent attestations carry so much weight in this industry.
Key management is the other half of the story. Wallet compromises often trace back to weak or exposed keys, not to broken cryptography. Our reporting on eMudhra’s cracked CA keys, where one was the number 4 shows how a trivially weak secret can undermine an entire trust chain. We are not suggesting CoinDCX had the same flaw. The point is that key hygiene, not headline-grabbing exploits, causes many real-world losses.
How On-Chain Investigators Trace Flagged Transfers
People like Darcy and ZachXBT work from public ledgers. They follow a suspect address, map where funds go, and flag exchanges, mixers or bridges along the route. USDT and TRX both move on chains where every transfer is visible, which makes this style of tracing possible without any insider access.
The method has strengths and limits. It reliably shows that value moved between addresses. It cannot show who controls an address, why a transfer happened, or whether the exchange was the victim or the operator. Attribution comes from labeling, pattern matching and prior knowledge of an exchange’s wallet clusters, and labels can be wrong.
That limit explains why the same data supports two stories. Investigators label the cluster as CoinDCX-linked and note outflows. CoinDCX agrees the cluster is its own but says the funds left in 2025. Without timestamps tied to the original breach, outsiders struggle to tell a replay of old theft from new theft. Stablecoin issuers sometimes freeze flagged balances once addresses are published, so rapid public tracing also has a practical purpose beyond reputation.
Disclosure Gaps and Why Silence Fuels Doubt
The strongest lever in this dispute is not the ledger. It is the absence of a loss figure. When a company confirms an incident but publishes no dollar amount, outsiders fill the silence with their own estimates. One report points to roughly $16 million in flagged transfers, and another notes that CoinDCX gave no figure for the operational loss.
Slow or partial disclosure has damaged other companies this year. In the Double Counter breach that exposed 28M Discord accounts, the size of the exposure only became clear after outside researchers dug in. The same dynamic applies here. A precise, early number protects a company, even when the number is ugly.
There is also a communication trap in the phrase “no user funds will be at loss.” It reassures customers but does not answer the investigators’ question. An exchange can be telling the truth about customer funds and still owe the public an explanation of what its old wallets did after the breach.
Historical Context: Indian Exchanges, CERT-In and Trust
India’s crypto market has operated under heavy scrutiny for several years. Exchanges there face tax pressure, banking friction and a regulatory stance that has stayed cautious. Against that backdrop, a security incident carries extra weight because users already question how much protection they can expect.
CoinDCX’s decision to report the July 2025 event to CERT-In followed the direction Indian authorities have pushed for cyber incidents. It showed procedural compliance. Compliance with a reporting rule is not the same as full transparency to customers, though, and that gap is where the current argument lives.
India’s wider data security record adds pressure. Our coverage of the SBI data leak that put 3,897 records on the dark web shows that financial institutions in the country are already fielding hard questions about breach handling. For more reporting in this space, see our cybersecurity coverage.
Two Narratives Compared
The dispute reduces to two competing stories. Laying them side by side shows where evidence would resolve the argument fastest.
| Question | CoinDCX’s account | Investigators’ account | What would settle it |
|---|---|---|---|
| Is this a new hack? | No, old wallets from July 2025 | Flagged transfers look like a loss, per reports | Timestamps linking transfers to the 2025 breach |
| Are current wallets safe? | Yes, per Sumit Gupta | Not directly contested in the verified record | An independent wallet audit |
| Was the address deprecated? | Yes, after the incident | ZachXBT challenges that a deposit address stayed in use | Migration records and address usage logs |
| Are customers exposed? | No, reserves 1:1 | Coinpedia headlines report calls to withdraw funds | Proof-of-reserves attestation |
| How much was lost? | No dollar figure given | About $16M flagged in transfers | A published loss statement |
Each row ends with a document the company could publish. That is the practical takeaway. The argument stays heated because the evidence that would cool it sits inside CoinDCX, and the company has so far promised an update, not delivered one.
Market and User Impact
No verified source in the record quantifies withdrawals, trading volume changes or any price effect tied to this dispute. We will not guess at them. What reporting does show is a reputational hit that arrives whether or not the investigators prove their case. An exchange whose security story is contested loses the benefit of the doubt with new users.
For existing customers, the risk calculus is straightforward. If the company is right, nothing changes. If the investigators are right, the exposure depends on whether segregation of customer assets holds. Neither outcome is visible to a retail user today, so caution is rational without being panicked.
What Users Can Do Now
Basic account hygiene matters more during a trust dispute, not less. Turn on the strongest login protection your exchange offers and avoid reusing passwords. Our guide to YubiKey setup for phishing-proof login walks through the hardware-key route, and the piece on passkey gaps and account takeovers explains why weak login methods keep getting exploited.
Users who want to reduce exposure can also keep only trading balances on any exchange and hold long-term savings in self-custody. That is a general practice, not advice specific to CoinDCX. It simply lowers the damage from any platform that later turns out to have a problem.
Regulatory Pressure Is Building on Stablecoins and Exchanges
The flagged assets here are mostly USDT, a stablecoin, and stablecoin oversight is tightening in several jurisdictions. We covered how the OCC finalized its GENIUS Act stablecoin rule for January 2027, and how South Korea’s crypto bill is nearing completion with a 50%+1 rule. Those moves target issuers and domestic frameworks, not Indian exchanges directly.
Still, they show the direction of travel. Regulators increasingly expect auditable reserves, clear incident reporting and clean records of how customer and company funds are separated. A dispute like CoinDCX’s lands in that environment and gives supervisors a live example of why transparency rules exist.
Predictions: What Happens Next
These are analyst judgments based on how similar disputes have played out, not reported facts. Each could be wrong.
- CoinDCX publishes a fuller timeline. Gupta promised an update, and the pressure to back it with wallet records is strong. A detailed migration log is the cheapest way to defuse the “new hack” reading.
- Investigators keep tracking the flagged addresses. Public ledgers make continued monitoring free, so any further movement will resurface the story quickly.
- The loss figure stays contested. Unless CoinDCX states a number, outlets will keep repeating the roughly $16 million flagged-transfer estimate, which may or may not equal the real loss.
- Pressure grows for independent reserve attestation. A third-party proof-of-reserves statement is the obvious way to support the 1:1 claim.
- Indian regulators stay quiet in public. CERT-In already received the July 2025 report, and public statements from authorities on a contested wallet history would be unusual.
The takeaway: this story will be settled by documents, not accusations. Whichever side produces timestamped evidence first will define how the episode is remembered.
Frequently Asked Questions
Was CoinDCX hacked again for $16 million? That has not been confirmed. Investigators flagged movements of about 15.99 million USDT and 5,783.81 TRX, but CoinDCX says the addresses are old wallets compromised in July 2025 and later deprecated. A new $16 million hack remains unconfirmed.
What did CoinDCX confirm about the July 2025 incident? Its official report, dated July 19, 2025, disclosed a security incident affecting an internal operational wallet. The company said it reported the matter to CERT-In and that customer assets were separate from the affected wallet.
Is CoinDCX actually lying? No source establishes that. The accusation is an allegation attributed to blockchain investigators, and CoinDCX calls the claims misleading. Until documents resolve the timeline, the word “lying” describes a dispute, not a finding.
Are user funds at risk on CoinDCX? The company says reserves are fully backed 1:1, and Sumit Gupta said no user funds will be at loss. Users cannot independently verify that today, which is why an independent reserve attestation would carry weight.
Who are Darcy and ZachXBT? Both are blockchain investigators. Darcy reported the flagged USDT and TRX movements. ZachXBT challenged CoinDCX’s explanation, including the claim that a CoinDCX deposit address stayed in use after the July 2025 incident.
How much did CoinDCX lose? The exact figure is unconfirmed. One report describes approximately $16 million in flagged transfers, while another says CoinDCX did not provide a dollar figure for the operational loss.
What should CoinDCX users do? Use the strongest login protection available, avoid password reuse, and keep only the balances you actively trade on any exchange. Watch for the company’s promised update and any independent reserve statement.
